QIF Guardrail Proposals

The QIF neurosecurity stack positions Neurowall and Runemate as sibling components at the I0 (Neural Interface) bottleneck of the hourglass model. Neurowall guards the inbound signal path. Runemate guards the outbound rendering path. Both rest on NSP for cryptographic transport.

Neurowall is a hardware-level security architecture for non-intrusive BCI wearables: smart glasses with temporal dry EEG/EOG sensors and subvocal collars with jawline EMG arrays. It provides three concentric defense layers that operate entirely on-device, with no dependency on a phone app or cloud service to enforce neural privacy.

Neurowall's detection pipeline has been tested against 15 TARA-mapped attack scenarios, including 5 adversarial-aware attacks designed by attackers who understand the defense architecture. Results from simulation (v0.7) with single-run 15-second observation windows.

Detection improves with observation time. At 20 seconds, all 9 attack types are caught with 5% false positive rate.

The most dangerous BCI attacks are the ones that slowly drift cognition without the subject's awareness. We call this class Sovereignty Attacks because they compromise the subject's sovereignty over their own neural state, violating Cognitive Liberty (CL) — the neurorights that protects the freedom to direct one's own thinking without external manipulation.

The covert nature is what makes these categorically different: the subject cannot refuse what they cannot perceive.

The L3 policy agent uses a RunematePolicy engine that evaluates a prioritized rule stack against live signal state. Each rule specifies conditions (NISS threshold, anomaly score, sustained window count, detector type) and actions (epsilon override, stimulation suppression, alert level). A 4-window cooldown prevents rapid oscillation between rules.

When a neural signal arrives at the BCI interface, how do you prove it hasn't been tampered with between ingestion and analysis? Classical logging can be forged. Neurowall's chain-of-evidence proposal uses blockchain-backed integrity hashing to create a tamperproof forensic record of every signal that crosses the I0 boundary.

Kellmeyer (2022) proposes that "trustworthy technological means (such as blockchain technology, differential privacy, homomorphic encryption)" be established for handling neural data and inferences on mental experience. QIF operationalizes this proposal at the signal layer: hash the raw signal at ingestion, chain it through processing layers, and detect tampering at any point in the pipeline.

TARA is the threat intelligence. Neurowall is the active defense. TARA-Neurowall is the convergence: a Brain SIEM that combines threat knowledge with real-time neural security monitoring. The same architecture Kevin built at every company — identify signals, classify security events, deploy detections, tune for false positives — applied to the brain.

The Neural Sensory Protocol is the cryptographic transport layer. Every neural data frame that leaves a BCI device passes through NSP's five-stage pipeline: compress, score, frame, encrypt, sign. NSP uses NIST-standardized post-quantum algorithms to protect against both classical and harvest-now-decrypt-later quantum threats.

Runemate provides the bytecode execution environment that runs security policy and multimodal content on-chip. The Forge compiler takes policy rules and neural UI definitions written in the Staves DSL, compiles them into compact bytecode, and the Scribe interpreter executes them on the device. This keeps security decisions local.